A Mac user might want to export his Keychain passwords and notes for several reasons – using a third-party password manager on Mac OS X, creating a time-resistant backup of passwords, printouts of passwords for the safe-deposit box or attorney, or switching to another operating system.
There’s no easy way to do this. Keychain Access only allows you to export certificates, and Apple recommends backing up the Keychain database files, which accomplishes none of the above goals and promotes lock-in.
The keychain code is itself open source, but I couldn’t find it compiled for another platform anywhere. I assume that enough of the OSX toolchain is required to make this infeasible, though likely not impossible. Still, it’s not there.
Fortunately, I ran across an Applescript that uses Keychain Scripting to create a text file from a user’s login Keychain. Unfortunately, it didn’t do a bunch of things I thought were required for moving my passwords to a Linux machine, so here’s the delta:
version 2009030201:
* handle all keychains
* handle all key types
* handle comments and descriptions
* handle errors
* trim dangling whitespace
* write to tab delimited format
* unlock all keychains first, so the mad tapping won’t hit ‘cancel’
* add username to filename
* replace carriage returns/newlines in text fields with spaces
* use unix line endings in output file
and some general code cleanup. I’m assuming the sample code is in the public domain and releasing this version under GPLv2+. Please improve this and comment here when you do or send changes back. If you own the original code and feel this is improperly licensed, let me know ASAP.
I’ve run this out of Script Editor – the advantage there is it’s easy; the disadvantage is double-confirming every keychain access, one for Script Editor, one for Keychain Scripting. Terribly time consuming. I suspect if you compile this it’ll eliminate the first half.
I’ve set this to open all the keychains first. Otherwise when hitting “allow, allow, allow” you might hit ‘cancel’ if it asks to unlock a keychain. If your keychain is big enough you might not get through the whole thing before the keychain unlock times out, so be careful.
Your minutes of tapping on the mouse button like a human waiting for a treat will be rewarded with a ~/Desktop/Passwords-yourusername file. It’ll be easy to then process with other scripts, importable into databases or spreadsheets for further manipulation. I’ll leave it up to you to be smart and not leave this password file sitting around in some unencrypted/unprotected location for any longer than absolutely necessary. If it gets stolen you’re probably up a creek, right? So, be careful, only aim at what you intend to kill.
Download KeychainExport.